Thompson, a 33-year-old software engineer who lives in the Seattle area, faces federal charges of wire fraud and computer crime and abuse. She remains in federal custody.

The defendant entered her plea during an arraignment on Thursday in federal court in Seattle. She faces up to 25 years in prison if convicted on both counts. A judge set a tentative trial date for Nov. 4, according to documents filed in the case.

Thompson's court-appointed attorneys did not reply to a request for comment.

On Aug. 4, Capital One confirmed that data from 100 million U.S. individuals as well as 6 million individuals in Canada appeared to have been stolen. A few days before, on July 29, the FBI arrested Thompson at her home and charged her with hacking into the bank's network using a misconfigured firewall to gain access to data stored within a cloud computing infrastructure.

After her initial arrest by FBI agents, the U.S. attorney's office in Seattle filed additional court papers in the case alleging that Thompson stole data from over 30 other businesses and organizations, based on servers found in her home that contained "multiple terabytes of data" (see: Prosecutors Allege Capital One Suspect Stole From Many Others).

Hacking Capital One

Sometime between March and July, Thompson took advantage of a misconfigured firewall within Capital's One network and then gained access to several years' worth of credit card data stored within the company's cloud storage system, according to the indictment.

Federal indictment against Paige A. Thompson

Although the cloud provider involved is not specified the indictment, Capital One has previously stated that it uses Amazon Web Services for its cloud infrastructure and that it also uses the company's Simple Cloud Storage Service, or Amazon S3, to store its data.

Thompson worked for Amazon Web Service for about a year between 2015 and 2016 in a division dedicated to developing S3 capabilities, according to news reports.

During the time she hacked into Capital One's network, she also took data from 30 other organizations that used the same cloud services provider, prosecutors allege. She also used the computing power she accessed to illegally mine for cryptocurrency, which is commonly referred to as cryptojacking, according to the indictment.

Prosecutors have not revealed the other organizations from which Thompson stole data, although court documents describe one as a state agency and another as a public research university.

To bypass security within the organizations she targeted, Thompson allegedly created tools to scan servers hosted by a cloud computing company, according to the indictment. She looked for misconfigured web application firewalls that would allow her to send commands from outside the network to access the data stored within the networks, the indictment alleges.

'Erratic'

It's not clear what Thompson, who used the handle "erratic" online, planned to do with the data she allegedly stole.

At one point, FBI investigators found that Thompson bragged on GitHub that she had taken Capital One data and was deciding what do with it, court documents show. On July 17, an unnamed GitHub user contacted Capital One's security team about the GitHub posting.

Capital One and prosecutors believe that only Thompson accessed the stolen data.

Thompson tried to conceal her identity and location while stealing data by using a virtual private networking service called iPredator as well as using the anonymizing Tor network to access the cloud computing servers, prosecutors allege.

Capital One Financial Corp., based in McLean, Virginia, is a financial holding company whose subsidiaries, which include Capital One, N.A., and Capital One Bank (USA), N.A., had $254.5 billion in deposits and $373.6 billion in total assets as of June 30.

About the Author

Ferguson is the managing editor for the news desk at Information Security Media Group. He's been covering the IT industry for more than 13 years. Before joining ISMG, Ferguson was editor-in-chief at eWEEK and director of audience development for InformationWeek. He's also written and edited for Light Reading, Security Now, Enterprise Cloud News, TU-Automotive, Dice Insights and DevOps.com.

Operation Success!

Risk Management Framework: Learn from NIST

From heightened risks to increased regulations, senior leaders at all levels are pressured to
improve their organizations' risk management capabilities. But no one is showing them how -
until now.

Learn the fundamentals of developing a risk management program from the man who wrote the book
on the topic: Ron Ross, computer scientist for the National Institute of Standards and
Technology. In an exclusive presentation, Ross, lead author of NIST Special Publication 800-37
- the bible of risk assessment and management - will share his unique insights on how to:

Understand the current cyber threats to all public and private sector organizations;

Develop a multi-tiered risk management approach built upon governance, processes and
information systems;